fix(kubernetes): validate MachineHealthCheck condition timeouts at render time - #3901

What this PR does

Follow-up to #3898, closing two gaps in the render-time duration guard it introduced. Context: #3513.

First, the guard now also covers the MachineHealthCheck condition timeouts (readyUnknownTimeout, readyFalseTimeout) in both the kubernetes and kubernetes-nodes charts. They need it more than the autoscaler annotation does: the CAPI webhook validates nodeStartupTimeout with a 30s floor but does not validate unhealthyConditions timeouts at all, so a zero or negative value used to apply silently and remediate a Machine the moment its Ready condition flipped, which for a KubeVirt worker means deleting the VM.

Second, the guard accepts the canonical form a Go duration serializes back to ("20m0s", "1h0m0s"). metav1.Duration prints that shape, so a value copied from kubectl get -o yaml output previously failed the render. The first segment must still be positive and later segments may be zero, so every accepted string still parses to a positive duration and the overflow and fraction-to-zero rejections stay.

Mechanically, the guard moves into a kubernetes.positiveDuration named template in each chart's _helpers.tpl, and the error message format is unchanged. Tests cover the canonical form on all three fields and the rejection of unitless, zero, and negative condition timeouts in both charts. The previous test case that passed unitless values through verbatim is reworked into rejections: a unitless value used to fail only at CAPI decode on apply, and a zero or negative one did not fail anywhere.

Downstream repositories

• No downstream repository is affected by this change
• cozystack/website - follow-up:
• cozystack/terraform-provider-cozystack - follow-up:
• cozystack/ansible-cozystack - follow-up:
• cozystack/ccp - follow-up:
• cozystack/talm - follow-up:
• cozystack/cozyhr - follow-up:
• cozystack/cozy-proxy - follow-up:
• cozystack/cozystack-telemetry-server - follow-up:
• cozystack/external-apps-example - follow-up:
• cozystack/examples - follow-up:

Release note

fix(kubernetes): reject zero and negative MachineHealthCheck condition timeouts at render time, and accept the canonical Go duration form ("20m0s", "1h0m0s") for the worker join timer values

Summary by CodeRabbit

• Bug Fixes

  • Added consistent render-time validation for node provisioning and health-check timeout values.
  • Rejects zero, negative, unitless, and improperly formatted durations with field-specific errors.
  • Supports canonical duration formats such as 20m0s and 1h0m0s.

• Documentation

  • Clarified accepted duration formats, validation behavior, timeout effects, and fallback handling across configuration references.